Indonesia Data Protection Laws and Regulations – Processing Personal Data

The principal law governing data protection in Indonesia is Law No. 11 of 2008 regarding Electronic Information and Transactions, as amended by Law No. 19 of 2016 ("Electronic Information Law"). In addition to the Electronic Information Law, rules governing personal data protection are also found in Government Regulation No. 71 of 2019 regarding the Implementation of Electronic Systems and Transactions ("GR 71") and Minister of Communication and Informatics Regulation No. 20 of 2016 regarding the Protection of Personal Data ("MOCI Reg. 20"). The Electronic Information Law, GR 71, and MOCI Reg. 20 are collectively referred to as the "PDP Regulations".

The key principles that apply to the processing of personal data are as follows:

Transparency

The PDP Regulations do not expressly identify transparency as a key principle, but the principle of transparency is reflected in certain obligations that apply to Electronic System Providers ("ESPs"). For example, ESPs must notify data subjects of data breaches within 14 days after the discovery of such breach.

Lawful Basis for Processing

The PDP Regulations mandate the obtainment of consent for any processing of personal data. In addition to consent, GR 71 stipulates other lawful bases other than consent for processing personal data, which are: (1) processing an individual\'s personal data in order to satisfy the obligations of a contract or to fulfil the request of such personal data owner when concluding an agreement; (2) the fulfilment of the legal obligation of the personal data controller in line  with the applicable laws and regulations; (3) guarding the vital interest of the personal data owner; (4) performing the legal obligation of the personal data controller; (5) performing the obligation of a public service personal data controller in the interest of the public; and (6) satisfying another valid interest of the personal data controller and/or the personal data owner.

Note, however, that the wording used in the relevant clause regarding lawful bases is rather ambiguous and may be interpreted to mean that consent is still required despite the existence of these lawful bases.

Although GR 71 uses the term "data controller" to define the above lawful bases, it provides no further guidance on the legal obligations of the data controller or their role and responsibilities. Moreover, GR 71 and the PDP Regulations do not define data processors or distinguish them from data controllers. Therefore, we understand that "data controllers" above primarily refer to ESPs.

Purpose Limitation

MOCI Reg. 20 provides that one of the key forms of personal data protection is that the processing of personal data must be in accordance with the original purpose of its processing. Further, GR 71 provides that ESPs must disclose the purpose of their processing of personal data to the data subjects.

Data Minimisation

MOCI Reg. 20 provides that ESPs may only use the personal data of data subjects in accordance with the needs of the data subjects. Further, GR 71 provides that ESPs must put in place a mechanism that accommodates the deletion of personal data if it has outlived its relevance.

Proportionality

The PDP Regulations do not address the proportionality principle.

Retention

MOCI Reg. 20 provides that ESPs must retain personal data for a minimum period of five years unless stipulated otherwise by sectoral regulations. Data may be retained beyond the five-year period if it is to be used in accordance with its initial purpose.

This is an excerpt from The International Comparative Legal Guide to: Data Protection 2020. 

This publication is intended for informational purposes only and does not constitute legal advice. Any reliance on the material contained herein is at the user's own risk. All SSEK publications are copyrighted and may not be reproduced without the express written consent of SSEK.